CVE-2025-3821: Pharmacy Management System XSS Vulnerability

CVE-2025-3821 Overview

CVE-2025-3821 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Web-based Pharmacy Product Management System 1.0. The flaw resides in add-admin.php, where the txtpassword, txtfullname, and txtemail POST parameters are rendered without proper output encoding. An authenticated attacker can inject arbitrary JavaScript that executes in the browser context of any user viewing the resulting page. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks against exposed deployments. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables script execution in administrator browser sessions, which may lead to session hijacking, defacement, or pivoting to additional administrative functions.

Affected Products

SourceCodester Web-based Pharmacy Product Management System 1.0
Vendor: senior-walter
Component: add-admin.php

Discovery Timeline

2025-04-20 - CVE-2025-3821 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3821

Vulnerability Analysis

The vulnerability affects the administrator creation workflow handled by add-admin.php. The application accepts the txtpassword, txtfullname, and txtemail fields from a POST request and reflects their values back into the HTML response without applying contextual output encoding. Any script payload supplied in those parameters is parsed by the browser as executable JavaScript.

Because the endpoint is reachable over the network and the application is a web-based management console, the injected script runs with the privileges of the authenticated administrator viewing the response. This exposes session cookies, CSRF tokens, and in-browser administrative controls. See the public XSS report for the proof-of-concept details.

Root Cause

The root cause is missing input validation and missing output encoding in the add-admin.php handler. User-controlled values from the txtpassword, txtfullname, and txtemail POST parameters are concatenated directly into the HTML response. The application does not apply HTML entity encoding, nor does it enforce a content security policy that would block inline script execution.

Attack Vector

An attacker with high-privilege access to the admin creation form submits a crafted POST request containing JavaScript inside one of the vulnerable parameters. User interaction is required because a victim administrator must load the reflected response. Once rendered, the payload executes in the victim's authenticated session, enabling cookie theft, forced actions, or redirection to attacker-controlled infrastructure.

No verified exploit code is published in a controlled PoC repository beyond the referenced write-up. The vulnerability mechanism is standard reflected XSS, documented in the VulDB entry #305728.

Detection Methods for CVE-2025-3821

Indicators of Compromise

POST requests to /add-admin.php containing <script>, onerror=, onload=, or encoded script fragments in the txtpassword, txtfullname, or txtemail parameters.
HTTP responses from add-admin.php echoing unescaped HTML tags inside form fields or confirmation messages.
Unexpected administrator accounts created from unfamiliar source IP addresses.
Outbound browser connections from admin workstations to unknown domains immediately after accessing the admin panel.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects POST bodies to /add-admin.php for script tags and event-handler patterns.
Enable application logging that captures the raw body of administrative form submissions for retrospective hunting.
Correlate admin-panel access logs with browser telemetry to detect anomalous script execution originating from internal pages.

Monitoring Recommendations

Alert on HTTP 200 responses from add-admin.php where the response body contains the same script-like substrings submitted in the request.
Monitor the administrator accounts table for unexpected inserts or modifications outside change-management windows.
Review browser error and CSP violation reports from administrator endpoints for inline script attempts.

How to Mitigate CVE-2025-3821

Immediate Actions Required

Restrict access to the admin panel to trusted IP ranges or VPN-only networks until a fix is applied.
Enforce multi-factor authentication for all administrator accounts to reduce the impact of session hijacking.
Audit recently created administrator accounts and revoke any that cannot be attributed to a legitimate change request.
Rotate administrator session cookies and credentials if any suspicious XSS activity is observed in logs.

Patch Information

No official vendor patch is currently referenced in the NVD entry for CVE-2025-3821. Organizations running SourceCodester Web-based Pharmacy Product Management System 1.0 should treat the deployment as unsupported for production use and plan migration or in-house remediation. Review the SourceCodester project page for any community-maintained updates.

Workarounds

Apply server-side input validation that rejects HTML metacharacters in the txtpassword, txtfullname, and txtemail fields of add-admin.php.
Add HTML entity encoding (for example, htmlspecialchars($value, ENT_QUOTES, 'UTF-8')) to every reflected variable in the admin templates.
Deploy a strict Content-Security-Policy header such as default-src 'self'; script-src 'self' to block inline scripts.
Place the application behind a WAF with managed XSS rulesets while a permanent code fix is developed.

bash

# Example WAF rule concept (ModSecurity)
SecRule REQUEST_URI "@endsWith /add-admin.php" \
    "id:1003821,phase:2,deny,status:403,\
     chain,msg:'CVE-2025-3821 XSS attempt blocked'"
  SecRule ARGS:txtpassword|ARGS:txtfullname|ARGS:txtemail \
    "@rx (?i)(<script|onerror=|onload=|javascript:)"